How to complete the challenge GET /api/secret/note (Bearer)

By Alan Richardson · Published 2026-07-31

First complete GET /api/secret/token (200) to obtain an X-AUTH-TOKEN value.

Then send GET /api/secret/note using that token as a Bearer token in the Authorization header. Do not send the token as X-AUTH-TOKEN for this challenge.

Try it now

If you do not already have an auth token, retrieve one with GET /api/secret/token. See the solution.

GET /api/secret/token to retrieve an auth token

GET /api/secret/note with a Bearer token to read the secret note

Lessons Learned

• Authorization: Bearer is the standard header form for presenting a token on protected reads.
• This challenge distinguishes framework-standard authorization from the API-specific X-AUTH-TOKEN header.
• The token value can be the same secret, but the header scheme changes how the server interprets it.

Suggested Experiments

• Send the valid token as Authorization: Bearer <token> and then as X-AUTH-TOKEN to compare supported auth styles.
• Omit the Bearer scheme word while keeping the token value and check whether the parser rejects it.

Experiment with this endpoint